skills.rest
Hack23
Hack23OFFICIAL
Explore all skills by this author →
WebsiteGitHub

secure-code-review

Guide security code reviews to identify vulnerabilities before production.

235|56|Updated Aug 1, 2015
Search Tags:#DAST#SAST#OWASP Top 10#secure-review#CodeQL#SonarCloud
One-click install
npx skills add https://github.com/Hack23/cia --skill secure-code-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secure-code-review
Source: https://github.com/Hack23/cia/tree/main/.github/skills/secure-code-review
Command: npx skills add https://github.com/Hack23/cia --skill secure-code-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a structured approach for performing security code reviews to identify vulnerabilities before they reach production, reducing risk across codebases.

Core Features & Use Cases

  • OWASP Top 10 & secure SDLC alignment: guidance to apply checklists during PR reviews and security audits.
  • SAST/DAST integration guidance: practical steps to incorporate tools like CodeQL and SonarCloud into the review process.
  • Threat modeling & secure design: prompts to consider data flows, authentication, and data protection during feature changes.
  • Use Case: before merging a critical feature, run the security review and document findings in PR, with mitigation tasks.

Quick Start

Initiate a security code review on a pull request using the recommended CodeQL and SonarCloud checks, and summarize findings in the PR.

Frequently Asked Questions about secure-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a secure code review for OWASP Top 10 vulnerabilities?▼

A secure code review identifies vulnerabilities before production by applying OWASP Top 10 checklists and secure SDLC guidance during pull request reviews, security audits, and refactoring.

How do I integrate SAST and DAST tools like CodeQL and SonarCloud into pull request reviews?▼

You can integrate SAST and DAST tools into pull request reviews by running recommended CodeQL and SonarCloud checks, then summarizing the security findings directly in the PR with mitigation tasks.

What is the best way to review third-party library integrations for security risks?▼

Reviewing third-party library integrations requires considering data flows, authentication, and data protection during feature changes to ensure secure design and compliance with secure development policies.

When do I need to run a security audit during feature refactoring?▼

You need to run a security audit during feature refactoring when handling sensitive data, ensuring that structural changes do not introduce vulnerabilities before merging to production.

Does this secure review process support threat modeling for data protection?▼

Yes, the secure review process supports threat modeling by prompting reviewers to consider data flows, authentication, and data protection mechanisms during feature changes and security audits.

Related Skills

Explore More Software Engineering Skills→
JamesPrialJamesPrial
1

github-actions-writer

Generate GitHub Actions workflows with security and performance best practices.

Community
Advanced
Manvendra08Manvendra08
1

django-security

Implement CSRF, XSS, and SQL injection protections in Django applications.

Community
Advanced
summarybotngsummarybotng
2

security-testing

Scan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.

Official
Advanced
JesusFigueroa25JesusFigueroa25

Security Engineer

Analyze application security via threat modeling, vulnerability assessment, and secure code review.

Community
Advanced